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DECLARATION OF JOSEPH CARBON 
PURSUANT TO 28 U.S.C. § 1746 


I, Joseph A. Carbon, state that I have personal knowledge of the facts and matters set forth 
below, and if called as a witness would testify competently thereto: 


1. ITamaU-sS. citizen over the age of eighteen years old. 


2. Iama Digital Forensic Analyst with CACTI, Inc., 6315 Bren Mar Drive, Suite 175, 
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Alexandria, VA 22312. Iam ACE Certified and have been practicing forensics for over 
two years. As part of my job duties, I often do contract computer forensic work for the 
Federal Trade Commission (FTC). 


On September 19, 2014, in connection with a pending lawsuit, FTC v. Butterfly 


Labratory, Hugh Huettner, Technical Forensic Examiner for the FTC, 400 D Street SW, 


Washington D.C., 20024 instructed me to forensically image digital media that was 
located at 10770 El Monte Street, Suite 101, Leawood, Kansas 66211. 


. LT arrived at 10770 El Monte Street, Suite 101, Leawood, Kansas 66211 on September 


19", 2014 in the early morning where the receiver, Eric L. Johnson, allowed me access to 
the premises. I was instructed by Leah Fraizer, who was the matter lead attorney for the 
FTC, to image select devices. 


The names of the forensically sound images taken at 10770 El Monte Street, Suite 101, 
Leawood, Kansas 66211 are listed below: 


BFL-ELM-IT02-JoshZerlan: Physical image of Samsung MZ-7PC256 256gb hard drive 
S/N: SOZ4NEAC834664 from custom generic desktop with no serial number. This 
image was stored on FTC Media 02, Western Digital WDSO00BPVT-OOHXZT3 S/N: 
WXHI1E93ZKJ49. This device was identified as belonging to Josh Zerlan. 


BFL-ELM-IT03b-DaveMcClain: Physical image of Seagate ST2000DMO001 2tb hard 
drive S/N: Z340S6F9. This image was stored on FTC Media 07, HGST 
HTS721010A9E630 S/N: 6PHE3KTE. This device was identified as belonging to Justin 
Rourden, though initially idenitified by the case team as belonging to Dave McClain. 


BFL-ELM-IT04a-Fishbowl: Memory and pagefile capture from custom generic server 
with no serial number. This image was stored on FTC Media 04, Western Digital 
WDSO00LPVX-22VOTTO S/N: WX21A34J7907. This server was identified by its label 
FISHBOWL. 
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BFL-ELM-IT04b-Fishbowl: Physical image of Samsung MZ-7TD120 120gb hard drive 
S/N: S14CNEACB08918 from custom generic server with no serial number. This image 
was stored on FTC Media 04, Western Digital WD5000LPVX-22VOTTO S/N: 
WX21A34J7907. This server was identified by its label FISHBOWL. 


BFL-ELM-IT04c-Fishbowl: Logical image of “BFLCloud” partition of size 1890gb 
found on Seagate ST4000DM000 4tb hard drive S/N: Z30101X1 from custom generic 
server with no serial number. This image was stored on FTC Media 04, Western Digital 
WDS5000LPVX-22VOTTO S/N: WX21A34J7907. This server was identified by its label 
FISHBOWL. 


BFL-ELM-IT04d-Fishbowl: Logical image of “FTP” partition of size 1835gb found on 
Seagate ST4000DMO000 4tb hard drive S/N: Z30101X1 from custom generic server with 
no serial number. This image was stored on FTC Media 04, Western Digital 
WD5000LPVX-22VOTTO S/N: WX21A34J7907. This server was identified by its label 
FISHBOWL. 


BFL-ELM-IT05-JoshZerlan: Physical image of Seagate ST320LT012-9WS14C 320gb 
hard drive S/N: SOV1030M from ASUS 1015E laptop S/N: D4NO0CX276730156. This 
image was stored on FTC Media 05, Western Digital WDSOO00LPV X-22VOTTO S/N: 
WX21A34L0252. This device was identified as belonging to Josh Zerlan. 


BFL-ELM-IT06a-DaveMcClain: Memory and pagefile capture from Lenovo ThinkPad 
X230 laptop S/N: R9-RXND7 12/08. This image was stored on FTC Media 06, Western 
Digital WD5000BPVT-00HXZT3 S/N: WXHIE93ZKR33. This device was identified as 
belonging to Justin Rourden, though initially idenitified by the case team as belonging to 
Dave McClain. 


BFL-ELM-IT06b-DaveMcClain: Physical image of Micron C400-MTFDDAK128MAM 
128gb hard drive S/N: 1220033CD595 from Lenovo ThinkPad X230 laptop S/N: R9- 
RXND7 12/08. This image was stored on FTC Media 02, Western Digital 
WDS5000BPVT-0OHXZT3 S/N: WXHIE93ZKJ49. This device was identified as 
belonging to Justin Rourden, though initially idenitified by the case team as belonging to 
Dave McClain. 


BFL-ELM-IT07a-DaveMcClain: Memory and pagefile capture from Lenovo ThinkPad 
W530 laptop S/N: PK-11ZYZ 13/09. This image was stored on FTC Media 06, Western 
Digital WDS5000BPVT-00HXZT3 S/N: WXHIE93ZKR33. This device was identified as 
belonging to Dave McClain. 
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BFL-ELM-IT07b-DaveMcClain: Physical image of Ricoh SD 8gb memory card S/N: 
0001 which was found inserted in Lenovo ThinkPad W530 laptop S/N: PK-1L1ZYZ 
13/09, This image was stored on FTC Media 06, Western Digital WDSO000BPVT- 
OOHXZT3 S/N: WXHIE93ZKR33. This device was identified as belonging to Dave 
McClain. 


BFL-ELM-IT07c-DaveMcClain: Physical image of Chronos MKNSSDCR240GB-DX 
240gb hard drive S/N: MK130801AS1068815 from Lenovo ThinkPad W530 laptop S/N: 
PK-11ZYZ 13/09. This image was stored on FTC Media 06, Western Digital 
WDS5000BPVT-00OHXZT3 S/N: WXH1E93ZKR33. This device was identified as 
belonging to Dave McClain. 


BFL-ELM-IT08-Ambralzanburg: Physical image of Seagate ST9500325AS 500gb hard 
drive S/N: S2WJR6R4 from Lenovo G570 laptop S/N: CB16608818. This image was 
stored on FTC Media 08, Western Digital WDS000LPVX-22VOTTO S/N: 
WX11A34K2891. This device was identified as belonging to Ambra Izanburg. 


BFL-ELM-IT1la-MarcGoodpasture: Memory and pagefile capture from Lenovo 
ThinkPad T520 laptop S/N: R9-PVWZN 11/2012. This image was stored on FTC Media 
11, Western Digital WD5000BPVT-00HXZT3 S/N: WXHIE93UMR95. This device 
was identified as belonging to Marc Goodpasture. 


BFL-ELM-IT11b-MarcGoodpasture: Physical image of generic 1gb thumb drive S/N: 
B30DA964 which was found inserted in Lenovo ThinkPad T520 laptop S/N: R9- 
PVWZN 11/2012. This image was stored on FTC Media 11, Western Digital 
WDS5000BPVT-OOHXZT3 S/N: WXH1E93UMR95, This device was identified as 
belonging to Marc Goodpasture. 


BFL-ELM-IT1 1c-MarcGoodpasture: Physical image of HGST HTS725050A7E630 
500gb hard drive S/N: YO9KZYW8M from Lenovo ThinkPad T520 laptop S/N: R9- 
PVWZN 11/2012. This image was stored on FTC Media 11, Western Digital 
WD5000BPVT-OOHXZT3 S/N: WXHIE93UMR95. This device was identified as 
belonging to Mare Goodpasture. 


BFL-ELM-IT12-MarcGoodpasture: Physical image of generic 512mb thumb drive S/N: 
CCFE2008d6d945d which was found in the room designated as N on the desk designated 
N2 next to the laptop indicated in BFL-ELM-IT11. This image was stored on FTC 
Media 11, Western Digital WD5000BPVT-00HXZT3 S/N: WXHIE93UMR95. This 
device was identified as belonging to Mare Goodpasture. 


BFL-ELM-IT15-SonnyVleisides: Physical image of Intel SSDSCMMW240A3L 240gb 
hard drive S/N: CVCS345300VU240C from Lenovo ThinkPad X1 Carbon laptop S/N: 
R9-WEVA8. This image was stored on FTC Media 13, Hitatchi HTS721010A9E630 
S/N: 6PHE182E. This device was identified as belonging to Sonny Vleisides. 
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5. 


I maintained the hard drives containing the above mentioned images in a secure location 
until September 20", 2014, where I handed and signed them over to Jason T. Sweeney, 
Digital Forensic Analyst for CACTI, Inc., 6315 Bren Mar Drive, Suite 175, Alexandria, 
VA 22312. I signed the FTC chain of custody form when I handed the hard drives to 
Jason T. Sweeney. The custody of the hard drives transferred at the collection site, 1077 
El Monte Street, Suite 101, Leawood, Kansas 66211. 


I declare under penalty of perjury that the foregoing is true and correct. 
Executed on the 25th day of September 2014, in Alexandria, VA. 


Qogh Lanbr— 


Joseph A. Carbon 
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